Bump Bazel to 9.0.1

### What does this PR do?

Upgrades the Bazel toolchain from 8.6.0 to 9.0.1.

### Motivation

9.0.1 ships two upstream fixes that directly benefit our build:

- bazelbuild/bazel#28606: NPE when `--repo_env` is set to an env var
  that has no value — contributed by Datadog (Joseph Gette).
- bazelbuild/bazel#26842: `DefaultSyscallCache` incorrectly treated
  `BUILD` files and `build` directories as the same entry on
  case-insensitive / normalizing filesystems (e.g. Linux container on
  a macOS host), causing spurious build failures.

### Describe how you validated your changes

`bazel test //...` passes.

### Additional Notes

Changes required:

- `.bazelversion`: 8.6.0 → 9.0.1
- `MODULE.bazel`:
  - `protobuf` 29.1 → 33.4 (resolved version in Bazel 9 dep graph)
  - `apple_support` 1.24.1 → 1.24.2
  - `libarchive` 3.8.1 → 3.8.1.bcr.2, whose transitive `bzip2` dep
    (pinned to 1.0.8.bcr.4 via `single_version_override`) ships a
    Bazel 9-compatible BUILD file with explicit `load()` statements
  - `gcc_toolchain`: add patch 0005 (see below)
- `bazel/toolchains/mingw/toolchain.bzl`: drop
  `provides = [CcToolchainConfigInfo]`; `CcToolchainConfigInfo` was
  never imported so it evaluated to `None`, which Bazel 9 rejects
- `bazel/patches/gcc-toolchain/0005-fix-bazel-9-compat.patch`:
  same fix for `gcc_toolchain`'s `cc_toolchain_config.bzl`; also
  adds explicit `cc_common` load and `cc_library` to the generated
  BUILD template, both required by Bazel 9

Author: rdesgroppes

.bazelversion

@@ -1 +1 @@
-8.6.0
+9.0.1

MODULE.bazel

@@ -42,9 +42,15 @@ archive_override(
 bazel_dep(name = "bazel_lib", version = "3.2.2")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "gazelle", version = "0.47.0")
-bazel_dep(name = "libarchive", version = "3.8.1")
+bazel_dep(name = "libarchive", version = "3.8.1.bcr.2")
+
+single_version_override(
+    module_name = "bzip2",
+    version = "1.0.8.bcr.4",
+)
+
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "protobuf", version = "29.1")
+bazel_dep(name = "protobuf", version = "33.4")
 single_version_override(
     module_name = "protobuf",
     patch_strip = 1,
@@ -333,6 +339,6 @@ include("//deps:go.MODULE.bazel")
 # This enables cross-compilation for macOS x86_64 on Apple Silicon.
 # Simply add --platforms=@apple_support//platforms:macos_x86_64
 # to the build command to enable it.
-bazel_dep(name = "apple_support", version = "1.24.1")
+bazel_dep(name = "apple_support", version = "1.24.2")
 
 use_repo_rule("//bazel/tools:bazelisk_check.bzl", "bazelisk_check")(name = "bazelisk_check")

MODULE.bazel.lock

@@ -0,0 +1,16 @@
+diff --git a/foreign_cc/private/framework.bzl b/foreign_cc/private/framework.bzl
+index 58307bc..af1d671 100644
+--- a/foreign_cc/private/framework.bzl
++++ b/foreign_cc/private/framework.bzl
+@@ -9,2 +9,3 @@ load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain")
+ load("@rules_cc//cc:defs.bzl", "CcInfo", "cc_common")
++load("@rules_cc//cc/common:cc_shared_library_info.bzl", "CcSharedLibraryInfo")
+ load("//foreign_cc:providers.bzl", "ForeignCcArtifactInfo", "ForeignCcDepsInfo")
+@@ -969,6 +970,3 @@ def _define_inputs(attrs):
+     for dynamic_dep in attrs.dynamic_deps:
+-        if not bazel_features.globals.CcSharedLibraryInfo:
+-            fail("CcSharedLibraryInfo is only available in Bazel 7 or greater")
+-
+-        linker_input = dynamic_dep[bazel_features.globals.CcSharedLibraryInfo].linker_input
++        linker_input = dynamic_dep[CcSharedLibraryInfo].linker_input
+         bazel_libs += _collect_shared_libs(linker_input)

bazel/patches/rules_foreign_cc/0004-fix-CcSharedLibraryInfo.patch

@@ -77,7 +77,10 @@ http_archive(
 # - bazel-contrib/rules_foreign_cc#1451: out_data_dirs in output groups
 # - bazel-contrib/rules_foreign_cc#1465: resource_set integration (fixes overcommitting)
 # - bazel-contrib/rules_foreign_cc#1470: -isystem forwarding to configure scripts
-# Patch 0002 is still carried locally (bazel-contrib/rules_foreign_cc#1452 not yet merged).
+# Patches carried locally (not yet merged upstream):
+# - 0002: bazel-contrib/rules_foreign_cc#1452
+# - 0003: bazel-contrib/rules_foreign_cc#1491
+# - 0004: bazel-contrib/rules_foreign_cc#1493
 bazel_dep(name = "rules_foreign_cc", version = "0.15.1")
 git_override(
     module_name = "rules_foreign_cc",
@@ -86,6 +89,7 @@ git_override(
     patches = [
         "//bazel/patches:rules_foreign_cc/0002-configure_make-provide-DY-LD_LIBRARY_PATH-based-on-t.patch",
         "//bazel/patches:rules_foreign_cc/0003-pass-j-flag-directly-on-make-command-line.patch",
+        "//bazel/patches:rules_foreign_cc/0004-fix-CcSharedLibraryInfo.patch",
     ],
     remote = "https://github.com/bazel-contrib/rules_foreign_cc",
 )

deps/repos.MODULE.bazel

@@ -21,6 +21,7 @@ if [ ! -d "${XDG_CACHE_HOME:-}" ]; then
 fi
 
 # Ensure `bazel` & managed toolchains honor `XDG_CACHE_HOME` as per https://wiki.archlinux.org/title/XDG_Base_Directory
+args=("$@")
 if [ -n "${XDG_CACHE_HOME:-}" ]; then
   if [[ "$XDG_CACHE_HOME" != /* ]]; then
     >&2 echo "🔴 XDG_CACHE_HOME ($XDG_CACHE_HOME) must denote an absolute path!"
@@ -29,9 +30,11 @@ if [ -n "${XDG_CACHE_HOME:-}" ]; then
   unset GOCACHE                               # https://pkg.go.dev/cmd/go#hdr-Build_and_test_caching
   export GOMODCACHE="$XDG_CACHE_HOME"/go/mod  # https://wiki.archlinux.org/title/XDG_Base_Directory#Partial
   unset PIP_CACHE_DIR                         # https://pip.pypa.io/en/stable/topics/caching/#default-paths
-  if [[ -n "${CI:-}" && -z "${GITHUB_ACTIONS:-}" ]]; then
-    exec "$BAZEL_REAL" ${1:+"$1" --config=ci} "${@:2}"
+  if [[ $# -gt 0 ]]; then
+    [[ -n "${CI:-}" && -z "${GITHUB_ACTIONS:-}" ]] && args=("${args[0]}" --config=ci "${args[@]:1}")
+    # Avoid `ERROR: The repo contents cache is inside the main repo. This can cause spurious failures.`
+    [[ "$XDG_CACHE_HOME" == "$(dirname "$(dirname "$0")")"/* ]] && args=("${args[0]}" --repo_contents_cache= "${args[@]:1}")
   fi
 fi
 
-exec "$BAZEL_REAL" "$@"
+exec "$BAZEL_REAL" "${args[@]}"

tools/bazel

@@ -41,6 +41,19 @@ if defined XDG_CACHE_HOME (
   set "XDG_CACHE_HOME=%~dp0..\.cache"
 )
 
+:: Build args (mirrors Linux args array), injecting --repo_contents_cache= when cache is inside workspace
+:: Avoid `ERROR: The repo contents cache is inside the main repo. This can cause spurious failures.`
+set "args=%*"
+for %%i in ("%~dp0..") do call set "xdg_stripped=%%%%XDG_CACHE_HOME:%%~fi\=%%%%"
+if "!xdg_stripped!" neq "!XDG_CACHE_HOME!" if not "%~1"=="" (
+  if "%~2"=="" (
+    set "args=%~1 --repo_contents_cache="
+  ) else (
+    call set "args=%%args:*%~1 =%%"
+    set "args=%~1 --repo_contents_cache= !args!"
+  )
+)
+
 :: Check legacy max path length of 260 characters got lifted, or fail with instructions
 set "more_than_260_chars=!XDG_CACHE_HOME!\more-than-260-chars"
 for /l %%i in (1,1,26) do set "more_than_260_chars=!more_than_260_chars!\123456789"
@@ -56,7 +69,7 @@ if not exist "!more_than_260_chars!" (
 
 :: Not in CI nor GitHub Actions: simply execute `bazel` - done
 if defined CI if not defined GITHUB_ACTIONS goto :ci_config
-"%BAZEL_REAL%" !bazel_home_startup_option! %*
+"%BAZEL_REAL%" !bazel_home_startup_option! !args!
 exit /b !errorlevel!
 :ci_config
 
@@ -72,7 +85,7 @@ exit /b !errorlevel!
 >&2 powershell -NoProfile -Command "Get-Process bazel,java -ErrorAction SilentlyContinue | Select-Object 🟡,ProcessName,StartTime"
 
 :: Payload: execute `bazel` and remember exit status
-"%BAZEL_REAL%" %*
+"%BAZEL_REAL%" !args!
 set bazel_exit=!errorlevel!
 
 :: Diagnostics: dump logs on non-trivial failures (https://bazel.build/run/scripts#exit-codes)